Protocols
JWKS
A JSON Web Key Set — the public keys an identity provider publishes so anyone can verify its signed tokens.
What JWKS means
A JWKS is the set of public keys a provider publishes at a well-known URL. Applications fetch it to verify token signatures without holding a shared secret, and the provider can rotate signing keys without coordinating with every client.
Defined in: RFC 7517 (JSON Web Key); discovery in OpenID Connect Discovery 1.0.
How it works
Each key carries an identifier. A signed token names the key that signed it in its header, so a verifier picks the right key from the set rather than trying each one.
Rotation works because a provider can publish a new key before signing with it. Clients that refresh the set see both, so tokens signed with either verify cleanly during the overlap. Clients that cached the set forever see only the old one, and every token fails the moment rotation completes.
The correct client behaviour is to cache with a sensible TTL and refetch when a token names an unknown key — with a rate limit on that refetch, since a flood of unknown key identifiers would otherwise be an easy way to hammer the provider.
The mistake people actually make
Hard-coding the public key from the JWKS at integration time. It works perfectly until the provider rotates, at which point every token fails at once and the cause is not obvious from the error.
Related terms
ID token
A signed JWT from an OpenID Connect provider carrying verifiable claims about the authenticated user.
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.